I mean “cloud only” in the sense that there isn’t a need to reach a physical on-prem server that sits behind a firewall. Small business here with all cloud based solutions in mind, ie Office 365, Zoom Phones, etc.
For those of you in similar cloud only environments - what you do?
No, you don’t need a VPN. Unless you have workers traveling or remote workers in countries where some services are blocked or can be monitored. In that case VPN is needed, but does not have to be onprem but something like ProtonVPN.
But if you want to be more secure, you can do something like IP filtering for cloud services (for everything or just for admin stuff) and allow only company IPs in which case VPN onprem is needed.